CVE-2026-50058: Solid Edge DFT File RCE Vulnerability

CVE-2026-50058 Overview

CVE-2026-50058 is an out-of-bounds read vulnerability in Siemens Solid Edge, a widely deployed computer-aided design (CAD) application. The flaw resides in the DFT file parsing routine and affects Solid Edge SE2025 versions prior to V225.0 Update 15 and Solid Edge SE2026 versions prior to V226.0 Update 7. An attacker who convinces a user to open a specially crafted DFT file can read memory outside the intended buffer boundary and potentially execute code within the context of the current process. The vulnerability is tracked under CWE-125: Out-of-bounds Read and was disclosed by Siemens in advisory SSA-621657.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the Solid Edge process, potentially compromising sensitive engineering data and providing a foothold on engineering workstations.

Affected Products

Siemens Solid Edge SE2025 (all versions before V225.0 Update 15)
Siemens Solid Edge SE2026 (all versions before V226.0 Update 7)
DFT file parsing component within Solid Edge

Discovery Timeline

2026-08-11 - CVE-2026-50058 published to NVD
2026-08-11 - Last updated in NVD database
2026-08-11 - Siemens publishes advisory SSA-621657

Technical Details for CVE-2026-50058

Vulnerability Analysis

The vulnerability is an out-of-bounds read triggered during the parsing of DFT (Draft) files used by Solid Edge. DFT files describe 2D drafting and detailing data associated with 3D CAD models. When Solid Edge processes a malformed DFT file, the parser reads memory beyond the boundary of the allocated buffer. This behavior can leak adjacent memory contents and, depending on process state, corrupt control flow to enable arbitrary code execution in the context of the current user. Because Solid Edge typically runs with the privileges of the engineer using the workstation, exploitation grants access to project files, intellectual property, and cached credentials in that user context.

Root Cause

The root cause is missing or insufficient bounds checking when the DFT parser dereferences pointers or indexes into structures derived from attacker-controlled file fields. The parser trusts size or offset values embedded in the file without validating them against the actual allocated buffer size, which is a classic manifestation of [CWE-125].

Attack Vector

Exploitation requires local file access and user interaction. The attacker must deliver a crafted DFT file through phishing, a shared engineering repository, a supply-chain drop, or a removable-media vector, and then persuade the target to open it in Solid Edge. Attack complexity is high, reflecting the need to reliably shape memory during parsing to achieve code execution rather than a simple crash. See the Siemens Security Advisory SSA-621657 for vendor-supplied technical context.

Detection Methods for CVE-2026-50058

Indicators of Compromise

Unexpected crashes of Edge.exe or related Solid Edge processes correlated with opening a DFT file from an untrusted source
DFT files received from external senders, cloud storage links, or removable media outside normal engineering workflows
Child processes spawned from Solid Edge that are not part of the standard CAD toolchain (for example, cmd.exe, powershell.exe, rundll32.exe)

Detection Strategies

Monitor for Solid Edge process crashes with exception codes indicating access violations during file parsing
Alert on any process created by Solid Edge that launches an interpreter, script host, or living-off-the-land binary
Inspect email and file-sharing gateways for .dft attachments and quarantine those from unverified senders

Monitoring Recommendations

Enable command-line and process-creation auditing on engineering workstations that run Solid Edge
Collect Windows Error Reporting (WER) telemetry for Solid Edge crashes and forward it to your SIEM for correlation
Baseline normal Solid Edge process behavior and alert on deviations such as network connections initiated during file open operations

How to Mitigate CVE-2026-50058

Immediate Actions Required

Upgrade Solid Edge SE2025 to V225.0 Update 15 or later
Upgrade Solid Edge SE2026 to V226.0 Update 7 or later
Instruct users to open DFT files only from trusted sources and verify provenance before opening any file received externally
Restrict inbound .dft files at email and web gateways pending patch deployment

Patch Information

Siemens has released fixed versions addressing the out-of-bounds read. Deploy V225.0 Update 15 for the SE2025 branch and V226.0 Update 7 for the SE2026 branch. Full remediation details are available in the Siemens Security Advisory SSA-621657.

Workarounds

Avoid opening DFT files from untrusted or unverified sources
Segment engineering workstations from general corporate networks to limit lateral movement if exploitation succeeds
Apply application allowlisting to prevent Solid Edge from spawning unexpected child processes

bash

# Verify installed Solid Edge version on Windows
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version" /s